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A quantum key distribution protocol with classical Bob based on polarization entangled photon pairs is pre- 
sented. It approximates a single photon and exploited the inherent randomness of quantum measurements to 
attain highly secure keys and high efficiency of the transmission. 
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I. INTRODUCTION 

Cryptography is a way to transform information so that it 
is unintelligible and therefore unless to those who are not 
meant to have access to it. Thus far, it is trusted that the only 
proven unconditionally secure crypto-system is the one-time- 
pad scheme. To employ this scheme, therefore, the two distant 
communicating parties must have a secure method to share a 
key that is as long as the message to be encrypted. However, 
it is not an easy task to share the secret keys between the two 
parties prior to the communication because they cannnot send 
a secret key by an open channel to the public. Fortunately 
Bennett-Brassard (BB84) 1 1] showed how to exploit the prop- 
erties of quantum mechanics for cryptographic purposes, in- 
dependently rediscovered by Ekert (E91) |2] a few years later, 
which was the beginning of quantum key distribution (QKD) 
and have been theoretically proven secure |3] when both par- 
ties are quantum. Up to now, many quantum key distribution 
(QKD) protocols have already been proposed IJ-ItI]. 

What is possible when only one party (Alice) is quantum, 
yet the other (Bob) has only classical capabilities? Recently, 
several "semi-quantum" key distribution protocols (SQKD) 
were proposed |8- 10]. Boyer et al. |8] suggested the idea of 
semiquantum key distribution using four quantum states. For 
convenience, we call such a protocol BKM2007. Zou et al. 
Uo] derived its simplification that requires only one quantum 
state, ZQLWL2009 for short. These protocols give an answer 
to how much "quantum" a protocol needs to be in order to 
achieve a significant advantage over all classical protocols. 

The conventional setting when both parties are quantum 
is as follow: Alice and Bob have labs that are perfectly se- 
cure, both of them can perform any quantum operations, and 
they use qubits for their quantum communication on a quan- 
tum channel and also have a classical authenticated channel 
which can be heard, but cannot be tampered with by the ad- 
versary. For SQKD protocol |8], a quantum channel travels 
from Alice's lab to the outside world and back to her lab. Bob 
can access a segment of the channel, and whenever a qubit 



passes through that segment Bob can either let it go undis- 
turbed or (1) measure the qubit in the computational basis 
{|1), |0)) which is also called "classical" basis; (2) prepare a 
(fresh) qubit in the classical basis, and send it. Bob is called 
classical Bob if he is limited to performing only operations (1) 
and (2) or doing nothing and could never obtain any quantum 
superposition of the computational basis states. If all the par- 
ties are classical, they would always be working with qubits in 
the classical basis which would then make the resulting pro- 
tocol be equivalent to an old-fashion classical protocol, and 
therefore, the operations themselves shall here be considered 
classical. So this kind of protocol is termed "QKD with clas- 
sical Bob" or "Semi-quantum key distribution". 
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The SQKD protocols 11 81-1 1011 have been proved being com- 
pletely robust which is an important step in studying security. 
Robustness of a protocol means that any attempt of an eaves- 
dropper to obtain information on the INFO string (the defini- 
tion of INFO string defined in Ref . fs^ : before Alice and Bob 
perform the ECC step) necessarily induces some eiTor which 
is detectable by the legitimate users. In particular, Boyer et al. 
[8] divided robustness into three classes: completely robust, 
partly robust, and completely nonrobust. A protocol is said to 
be completely robust if nonzero information acquired by Eve 
on the INFO string implies nonzero probability that the legit- 
imate participants find eiTors on the bits tested by the proto- 
col. A protocol is said to be completely nonrobust if Eve can 
gain the INFO string without inducing any eiTor on the bits 
tested by the protocol. A protocol is said to be partly robust if 
Eve can acquire some limited information on the INFO string 
without inducing any error on the bits tested by the protocol. 
Partly robust protocols could still be secure, but completely 
nonrobust protocols are automaticaly proven insecure . 

Both BKM2007 and ZQLWL2009 have a common prob- 
lem: the sources of the photons are attenuated laser pulses 
which have a nonzero probability to contain two or more 
photons, leaving such systems subject to the so-called beam 
splitter attack which has been discussed in Ref. fTT]. Us- 
ing entangled photon pairs as generated by parametric down- 
conversion allows us to approximate a conditional single pho- 
ton source fl^ with a high bit rate 1 13], and yet a very low 
probability for producing two pairs simultaneously. And our 
protocol is more efficient than BKM2007 and as efficient as 
ZQLWL2009. 
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In section II, we present an efficient SQKD protocol us- 
ing Bell state which exploiting the features of entangled pho- 
ton pairs for generating highly secure keys. In section III, we 
prove our protocol being completely robust. Finally, we give 
a brief discussion and conclusion. 



II. SCHEME FOR QKD WITH CLASSICAL BOB 

To define our protocol we first introduce the four polar- 
ization entangled states \(p^) - -^(|00) + |11)) and |i/'=^) - 

-^(|01) + 1 10)), which are created directly using parametric 
down-conversion by the method described in Ref. |fl2ll . \(p'^) 
and are also known as Bell or EPR state. A SQKD proto- 
col using Bell state to construct is described in the following. 

(1) Quantum Alice and classical Bob agree on that the Bell 
state 10^) and |i/f^) represent one bit classical information 
and 1, respectively. 

(2) Alice prepares an ordered = 4n(l + S) EPR pairs 
in the state \^^) - -^(|00) + |11)), where integer n is the 
desired length of the INFO string and S > is a fixed pa- 
rameter. And Alice divides the ordered EPR pairs into two 
partner-photon sequences [Pi(H),P2(H),P3(H), ■ ■ ■ ,PNiH)] 
and [Pi(T),P2(T),P3(T),--- ,Pn(T)]. Here and 
PiiT) are the two photons correlated with each other in 
the ith (/ = 1,2, - ^A^) EPR photon pair. We call 
[Pi (H), PiiH), PiiH), - - , Pn(H)] the home sequence or sim- 
ply the H-sequence; the another sequence is called travel se- 
quence or the T-sequence for short. 

(3) For each qubit in the H-sequence, Alice randomly se- 
lects whether to apply the Pauli operation X = |0)(1| + |1)(0| 
or do nothing. We notice that by performing the Pauli opera- 
tion X, it transforms the state |0^) into |i^^). Then she stores 
the H-sequence and sends the T-sequence to Bob through the 
quantum channel. 

(4) For each qubit arriving. Bob chooses randomly either 
to reflect it (CTRL) or to measure it in the computational ba- 
sis and resend it in the same state he found (to SIFT it). He 
records the results of the measurement which is completely 
secret to any other person other than Bob himself. Qubits are 
sent one by one, i.e., Alice sends a qubit only after receiving 
the previous one and Bob resends a qubit immediately after 
receiving it |8]. 

(5) Alice uses an A^-qubit register to save all photons com- 
ing back from Bob. Then she tells Bob through a classical 
channel that she has received the photon sequence. 

(6) After hearing from Alice, Bob announces which qubits 
he chose to CTRL. It is expected that for approximately j 
qbits of T-sequence, Bob chooses randomly to reflect them. 
We refer to these qbits as Tctrl, and the corresponding qubits 
in the H-sequence is called Hqtrl- We refer to the qubits Bob 
chose to SIFT as Tsift, and the correlated partner-photon is 
HsiFT- They abort the protocol if the number of Tsift bits is 
less than 2n; this happens with exponentially small probabil- 
ity. 



TABLE I. Relations of the initial state, measurement results of Hsift 
, Tsift and Raw key. 
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(8) Alice checks the error rate on the Tctrl in the foHowing 
way. She makes Bell measurement on the CTRL qubit (qubit 
in the Tctrl) and corresponding home qubit (qubit in the H- 
sequence) and compares the measurement result and the cor- 
responding initial EPR state, if they are inequal, some errors 
may happen. If the error rate on the Tctrl is higher than some 
predefined threshold Pctrl, the protocol aborts, otherwise the 
next step is executed. 

(9) AHce measures particles of Hsift and particles of Tsift 
in the computational basis, and chooses ar random n Hsift 
to be TEST qbits. She publishes which are the chosen qbits. 
Bob publishes the measurement results {of Tsift) correspond- 
ing to the TEST qubits. Alice compares the results of these 
measurements. If they are indeed perfectly correlated, Alice 
and Bob can certain that there is no eavesdropping; otherwise, 
they abort the protocol. 

(10) Alice announces the measurement results of the re- 
maining Hsift- Bob obtains the raw key by comparing the 
measurement results of Hsift and Tsift, which is shown 
clearly in TABLE. |T] Alice and Bob select the first n raw key 
to be used as INFO string. 

(11) Then Alice announces error correction code (ECC) and 
privacy amplification (PA); she and Bob use them to extract 
the ;«-bit final key from the n-bit INFO string. 



III. SECURITY ANALYSIS 

Now, we discuss the security of our protocol. Firstly, when 
Alice sends T-sequence to Bob, an eavesdropper Eve who 
wants to get the information on the initial states, may inter- 
cept this particle and resend a fake particle instead according 
to her measurement result. Because the state of particle in 
T-sequence is 

PT, = TrH,(p„,T,) = ^(|0)<0| + IDdl) = ^, (1) 

where / = 1 , 2, 3, ■ ■ ■ , A^. This state has no dependence upon 
the initial entangled states, and thus any measurements per- 
forms by Eve will contain no information about the initial 
states, thus preventing Eve from knowing the secret key. And 
we show that if Eve resends a fake particle to Bob, for exam- 
ple, this fake particle is in the state \(Pe} - c|0) -i- ii|l), where 
|cp + \d\^ = 1. If Bob chooses to reflect it. The state of the 
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fake particle and the home particle is 

PH£ = ^(10X01 + UXH) 

<S>(c^\0}{0\ + ct/*|OXl| + cV|lXO| + d-\l}{l\). (2) 

When Alice and Bob make eavesdrop checking, Alice makes a 
Bell measurement on this fake particle and home particle and 
she will get any one of four Bell states with equal probability 
|. So the error rate introduced by Eve is |. 

Furthermore, the most general attack of Eve can be de- 
scribed by a unitary operator Ue, which causes one or both 
of the EPR particles to interact coherently with an auxiliary 
quantum system available to her for subsequent measurements 
of her own. The most general global state before Bob decides 
whether to SIFT or CTRL is of the form 

lO) = mHT\A)E + \01}ht\B}e 

+ mHT\C}E + \n}HT\D)E, (3) 

where |A), \B}, |C) and \D} are Eve's choices for states of her 
system, which she does not even have to decide how to mea- 
sure until after Alice and Bob have gone public. 

Suppose the initial state Alice prepares is \<p'^}. On the 
qubit coming back. Eve applies the unitary Ue', if Bob 
sifted, the global state before Eve applies Ue is \QQ}ht\A}e + 
\11}ht\D}e- Once Eve has applied Ue, it must be such 
that Ue\00)ht\A)e = |00>Hr|£o)£ else the SIFT can de- 
tect an error, and similarly Ue\11)ht\D)e = \11)ht\E\)e- 
Due to the linearity of quantum mechanics, if Bob re- 
flects (CTRL), the resulting final state must be t/^IO) - 

m„T\Eo}E + \n}HT\El}E. As UEm = |0+W(|£o>£ + 

l^i)^) + \(I>')ht(\E())e - \Ei)e) and \(I>')ht to have probabil- 
ity of being measured by Alice, |£'o)£ = \Ei)e must hold. 

Similarly, if the initial states is Itfr^). On the qubit coming 
back. Eve applies the unitary Ue', if Bob sifted, the global 
state before Eve applies Ue is \Q1)ht\B)e + \ ^0}ht\C}e- Once 
Eve has applied Ue, it must be such that Ue\01)ht\B)e - 
\QI}ht\E\}e else the SIFT can detect an error, and similarly 
UE\iO}HT\C)E - \10)ht\Eo)e- Due to the linearity of quantum 
mechanics, if Bob reflects (CTRL), the resulting final state 
must be UEm = |10)Hr|£o>£ + |01)Hr|£i)£. As t/slO) = 
\iI^^)ht(\Ei}e + \Eo}e) + ir)Hr(|£i)£ - \Eo)e) and I^W to 
have probability of being measured by Alice, \E())e = l^i)^ 
must hold. 

So the final state is UeW - \4>^}ht\Eo}e if the initial 
state is \(P^)ht and UeW) - \^^)ht\E{))e if the initial state 
is \\Ij^)ht- Thus the only faked source sure of passing Alice's 
and Bob's checking is one in which Eve's system is entirely 
uncorrelated with the EPR particles, so that a subsequent mea- 
surement on it tells her no information. 

As Eve may gain a certain amount of information without 
being detected, for example. Eve measures the SIFT bits in 
computational basis. So to reduce Eve's information to an 
arbitrarily low value, some privacy amplification protocols are 
needed. After privacy amplification Alice and Bob would end 
up with a shared random sequence. 



TABLE II. Efficiency of BKM2007, ZQLWL2009 and our protocol. 
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IV. CONCLUSION 

Our protocol is efficient in that it uses all Bell states in dis- 
tributing the key except those, approximately half of the Bell 
states, chosen for checking eavesdropping. This is different 
from the BKM2007 where only | of the particles are used as 
keys. We now study the efficiency of the protocol. We con- 
sider the definition given in Ref. il4tl . 



where bs is the length of the INFO string, q, is the number of 
transmitted qubits on the quantum channel, and b, is the num- 
ber of transmitted bits on the classical channel. Here the clas- 
sical bits used for eavesdrop checking have been neglected. 
And the efficiency of our protocol (approximate |) is higher 
than that of the BKM2007 protocol (about ^) and not lower 
than that of the ZQLWL2009 protocol (about \), which is 
shown in TABLE. |II] From a theoretical point of view the 
scheme provides an interesting and new extension of Boyer et 
al.'s original idea using Bell state, and give an efficient and se- 
cure protocol; but from a practical point of view it may be dif- 
ficult to realize because building a reliable quantum memory 
is still a major research goal in experimental quantum physics 
|i, 15,-1 7] and current technology allowing storage time is still 
limited. 

In conclusion, we present a SQKD protocol using Bell state 
that is secure against beam splitter attack and more efficient 
than BKM2007 and as efficient as ZQLWL2009. 
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